CVE-2026-3257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3257", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-02-26T12:04:48.010Z", "datePublished": "2026-03-05T01:35:12.789Z", "dateUpdated": "2026-03-05T16:34:39.834Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "UnQLite", "product": "UnQLite", "programFiles": ["unqlite/unqlite.c"], "repo": "https://github.com/tokuhirom/UnQLite", "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "0.06", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-03-05T01:35:12.789Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/TOKUHIROM/UnQLite-0.07/source/Changes"}, {"tags": ["vendor-advisory", "related", "vdb-entry"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-3791"}, {"url": "https://unqlite.symisc.net/"}], "solutions": [{"lang": "en", "value": "UnQLite for Perl has been deprecated since version 0.06. Migrate to a different solution."}], "source": {"discovery": "UNKNOWN"}, "title": "UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library", "workarounds": [{"lang": "en", "value": "Upgrade to UnQLite for Perl version 0.07 or later."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T16:33:50.730722Z", "id": "CVE-2026-3257", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:34:39.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-3257", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-05T16:33:50.730722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T16:34:18.464Z"}}], "cna": {"title": "UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/tokuhirom/UnQLite", "vendor": "TOKUHIROM", "product": "UnQLite", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.06"}], "packageName": "UnQLite", "programFiles": ["unqlite/unqlite.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "UnQLite for Perl has been deprecated since version 0.06. Migrate to a different solution."}], "references": [{"url": "https://metacpan.org/release/TOKUHIROM/UnQLite-0.07/source/Changes", "tags": ["release-notes"]}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-3791", "tags": ["vendor-advisory", "related", "vdb-entry"]}, {"url": "https://unqlite.symisc.net/"}], "workarounds": [{"lang": "en", "value": "Upgrade to UnQLite for Perl version 0.07 or later."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1395", "description": "CWE-1395 Dependency on Vulnerable Third-Party Component"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-03-05T01:35:12.789Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3257", "state": "PUBLISHED", "dateUpdated": "2026-03-05T16:34:39.834Z", "dateReserved": "2026-02-26T12:04:48.010Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-03-05T01:35:12.789Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "UnQLite", "product": "UnQLite", "programFiles": ["unqlite/unqlite.c"], "repo": "https://github.com/tokuhirom/UnQLite", "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "0.06", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tokuhirom:unqlite:*:*:*:*:*:perl:*:*", "matchCriteriaId": "E9DB99D4-E76E-44B5-B1C6-69D1EE50F8B2", "versionEndExcluding": "0.07", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library.\n\nUnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow."}, {"lang": "es", "value": "Las versiones de UnQLite hasta la 0.06 para Perl utilizan una versi\u00f3n potencialmente insegura de la biblioteca UnQLite.\n\nUnQLite para Perl incrusta la biblioteca UnQLite. La versi\u00f3n 0.06 y anteriores del m\u00f3dulo Perl utilizan una versi\u00f3n de la biblioteca de 2014 que puede ser vulnerable a un desbordamiento basado en el mont\u00f3n."}], "id": "CVE-2026-3257", "lastModified": "2026-06-17T10:43:17.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3257", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-05T16:33:50.730722Z", "version": "2.0.3"}}]}, "published": "2026-03-05T02:16:52.150", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/TOKUHIROM/UnQLite-0.07/source/Changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Product"], "url": "https://unqlite.symisc.net/"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-3791"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.06]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "UnQLite", "source": "cna", "vendor": "TOKUHIROM"}, "product": "unqlite", "vendor": "tokuhirom"}], "analysis": {"en": {"generated_at": "2026-04-16T12:59:25.532526+00:00", "value": {"mitigation_remediation": ["Upgrade to UnQLite for Perl version 0.07 or later.", "Plan and execute migration to an alternative persistence solution that does not rely on the UnQLite library.", "Limit or sanitize any untrusted input that the Perl application processes until the upgrade or migration is complete.", "Monitor the application for anomalous memory usage or crashes that could indicate exploitation attempts."], "summary": {"action": "Apply Upgrade", "impact": "Potential Remote Code Execution via heap overflow"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the TOKUHIROM UnQLite Perl distribution. Clients using UnQLite for Perl version 0.06 or earlier are exposed. No specific patch version is available for those releases; the module has been deprecated since 0.06 and newer releases (0.07+) embed a fixed library.", "description_and_impact": "UnQLite for Perl embeds the UnQLite database engine. Versions up to and including 0.06 contain an older UnQLite library dated 2014 that was identified as having a heap-based buffer overflow. If an attacker can supply crafted input to the Perl module, the overflow could corrupt memory and potentially allow arbitrary code execution or denial of service. This weakness is categorized as CWE-1395.", "risk_and_exploitability": "The CVSS score of 9.8 indicates critical severity, but the EPSS score shows a very low probability of exploitation (<1%). The issue is not currently listed in the CISA KEV catalog. Attackers would need to interact with a Perl application that loads the vulnerable module, but the potential for remote exploitation cannot be ruled out if the application processes untrusted data."}}}}, "created": "2026-03-06T15:18:01.416484+00:00", "updated": "2026-04-16T13:00:11.095024+00:00", "vendors": ["tokuhirom", "tokuhirom$PRODUCT$unqlite"]}